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© Mutual monitoring circuits for monitoring any ab- 
normality of a plurality of microcomputers in a con- 
trol circuit controlled thereby. Monitoring circuits are 
provided in two microcomputers, respectively, to 
monitor any abnormal behavior of their counterparts. 
Each mutual monitoring circuit has a judging unit for 
giving judgement on whether or not there is ab- 
normality by measuring the pulse frequency and 



duty of the pulse signals and for outputting ab- 
normality judgement signals upon detecting any ab- 
normality. The judgement signals are sent directly to 
an input signal line in a driving circuit of a failsafe 
relay as a load shut-off mechanism, thereby chang- 
ing its abnormality signals to a low level. This in turn 
stops the output of the driving circuit, thus shutting 
off the failsafe relay. 
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This invention relates to a monitoring control 
circuit for monitoring a plurality of computers, more 
specifically for detecting any malfunctions or 
runaway of computer for controlling antilock brake 
system (ABS) for an automobile adapted to prevent 
locking of the wheels of the automobile by adjust- 
ing the pressure of brake fluid when applying a 
quick brake or the brake on a slippery road, there- 
by monitoring the system in a normal state. 

An electric control circuit of ABS calculates 
wheel speeds and slip rates in a computer on the 
basis of information from wheel speed sensors 
mounted near the wheels and controls, based on 
the results of calculation, the hydraulic unit which 
adjusts the pressure of brake fluid more efficiently. 
Various types of such circuits are known. 

Such an electric control circuit of ABS plays an 
important role of controlling the hydraulic unit, high 
safety and absolute reliability are essential require- 
ments. Most typically, such a circuit includes at 
least two microcomputers provided parallel to each 
other and arranged so as to monitor each other. 

An electric control circuit of ABS shown in Fig. 
2 by way of example has two microcomputers MC 0 
and MCi (#0, #1). Wheel speed information sup- 
plied from wheel speed sensors S1 - S4 is 
branched in parallel in the form of pulse signals 
through an input processing circuit D and inputted 
in the respective computers. The computers per- 
form arithmetic operations based on the input sig- 
nals according to a predetermined program and 
give output signals OUT based on the results of 
arithmetic operations. These output signals are 
supplied to solenoid valves or the like as loads to 
control the braking pressure in the hydraulic line. 

During normal and antilock control operations 
by the microcomputers, watchdog pulse signals 
WDPo and WDPi outputted from the two micro- 
computers MCo and MCi are inputted in a watch- 
dog circuit WDC to monitor these signals and thus 
monitor any abnormality of the computers. In the 
watchdog circuit WDC, the watchdog pulse signals 
are compared and judgement is made. As far as 
the two microcomputers are both normal, judge- 
ment signals WD are outputted. 

Also there is a monitoring circuit HWC for 
monitoring regulated voltage that is a power supply 
of the microcomputers. As far as the voltage is 
normal, that is, lower than a predetermined value, 
HW is outputted. The WD signals and HW signals 
are sent through an ANDi gate to another gate 
AND 2 . 

Besides the above monitoring signals, failsafe 
signals FS 0 and FSi are outputted from the re- 
spective microcomputers MCo and MCi . The sig- 
nals will turn to an L0 output if any abnormal 
behavior is detected during normal and antilock 
control operations. These signals are sent to the 
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AND 2 gate. If the abovesaid signals are all normal, 
the AND2 gate outputs signals to actuate a driving 
circuit FET and to activate a failsafe relay FSR. In 
this state, solenoid valve and a motor relay having 

5 loads X are in operative condition. Thus, if any one 
of the input signals to the AND 2 gate turns out to 
be abnormal, the failsafe relay FSR is cut off so 
that the antilock controlling is inhibited. 

In a known method, if watchdog pulse signals 

70 from a main to sub-microcomputer are normal, the 
main one controls the loads X and if not, the loads 
X are deactivated by operating the failsafe relay 
immediately. In other method, the two microcom- 
puters are treated equally. They monitor each other 

75 in detail. And if their calculated value such as 
acceleration, deceleration and vehicle speed is not 
identical, the loads X are deactivated by operating 
the failsafe relay. There is a watchdog timer circuit 
outside the microcomputers which monitor the 

20 watchdog pulse signals from the microcomputers. 
If the watchdog pulse signals are abnormal, the 
loads X are deactivated by operating the failsafe 
relay immediately. 

In such a conventional monitoring circuit for 

25 monitoring the behavior of microcomputers, the 
normal watchdog pulse signals from the respective 
microcomputers are given to the watchdog circuit 
as far as the microcomputers are normal. A watch- 
dog timer is triggered at predetermined time inter- 

30 vals. 

Thus, if one of the microcomputers should mal- 
function and stop producing output signals or pro- 
duce output signals having abnormal pulse widths, 
the watchdog timer will not be triggered, so that 

35 malfunction of the microcomputer is detectable. 

But since such a conventional monitoring cir- 
cuit using a watchdog timer is provided outside the 
microcomputers, if the microcomputers used are 
general-purpose ones, there will arise the problem 

40 of layout of parts in designing the circuit, that is, 
the problem of installation space. Further, the use 
of gate arrays or linear IC's will push up the cost. 

An object of this invention is to provide mutual 
monitoring circuits which are free of the above- 

45 described problems and, which are mounted in the 
respective microcomputers to monitor watchdog 
pulse signals mutually and output abnormality 
judgement signals, if one or some of the micro- 
computers are found out to be abnormal, to actuate 

so a load shut-off mechanism immediately, and which 
are simple in structure and less expensive and can 
cope with any runaway state and thus are highly 
reliable. 

The present invention provides an electronic 
55 control circuit having a plurality of microcomputers 
which operate by mutually independent oscillating 
sources, wherein input signals such as speed in- 
formation are divided and inputted in the respective 
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microcomputers, the microcomputers performing 
arithmetic operations according to a predetermined 
program based on the input signals, the electronic 
control circuit giving output control signals based 
on the results of the arithmetic operations; a mutual 
monitoring circuit for monitoring the plurality of 
microcomputers, a monitoring circuit provided in 
the each microcomputer and being operative with- 
out any software for monitoring the other micro- 
computer, the one microcomputer sending watch- 
dog signals to the monitoring circuit of the other 
microcomputer; a judgement unit provided in the 
monitoring circuit and receiving watchdog signals 
from the other microcomputer and judging whether 
the microcomputer is normal or not, and; a load 
shut-off means receiving the result of judgement 
and shutting off a load to be controlled if judged 
abnormal. 

In this case, the judgment units can preferably 
judge the pulse width and duty of the watchdog 
signals. 

Also, an input signal line of the load shut-off 
mechanism may be a negative-logic AND circuit 
and the signals from the judgement unit may be 
applied to the AND circuit, thereby shutting off the 
load with the load shut-off mechanism if the result 
of AND operation is abnormal. 

Further, though each judgement unit outputs an 
abnormal judgement signal as soon as it detects 
any abnormality, it may output a normal judgement 
signal when the other microcomputer returns to 
normal only after detecting a predetermined num- 
ber of normal signals continuously or after detect- 
ing normal pulse signals continuous during a pre- 
determined time. 

Further, each microcomputer preferably has a 
monitoring circuit which judges whether other 
microcomputer is normal or not. 

Otherwise, after turning power on and releasing 
resetting in the electronic control circuit, an initial 
test is performed in which the watchdog pulse 
signals produced by the each microcomputer are 
converted deliberately into abnormal signals and 
sent to the monitoring circuit in the other micro- 
computer to check the monitoring function of the 
respective monitoring circuits. 

Also, each microcomputer may have its spe- 
cific external terminal set at High or Low whereby 
each microcomputer can be set in a mode wherein 
the oscillation of quartz oscillators cannot be stop- 
ped by software. 

According to this invention, if one or some of 
the microcomputers malfunctions or gets into an 
abnormal state, the mutual monitoring circuits de- 
tect such abnormal state and send judgement sig- 
nals to the load shut-off mechanism to shut off the 
load. 
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Similarly, if all the microcomputers should fail, 
they can be mutually monitored by means of the 
monitoring circuits which are contained therein and 
operate without interposing software. Further, since 
5 the oscillation of the quartz oscillators cannot be 
stopped with software, it is possible to detect any 
abnormal state reliably and send judgement signals 
to the load shut-off mechanism to shut off the load. 
The input signal line of the load shut-off 
io mechanism is a negative-logic AND circuit. If any 
one of the abnormality judgement signals such as 
those representing abnormal in response to watch- 
dog pulses or an abnormal signal as to regulated 
voltage that is a power supply of the microcom- 

15 puters is inputted, the load shut-off mechanism is 
activated, thus shutting off the load. 

After turning power on and releasing resetting, 
watchdog pulse signals produced by one computer 
are converted deliberately into abnormal signals in 

20 various patterns and transmitted to the monitoring 
circuit in the other computer to check the monitor- 
ing function of the respective monitoring circuits. 
The loads are actually shut off by some of the 
patterns and the monitoring circuit monitors this 

25 fact. But with most other patterns, the monitoring 
function can be electrically checked at high speed 
by monitoring the results of judgement on their 
own without being limited by the mechanically de- 
termined time for shutoff and connection of the 

30 loads. 

The mutual monitoring circuits according to the 
present invention are extremely simple in structure 
and thus can be manufactured at low cost. Still, 
they can respond to any abnormal state in the 
35 most appropriate manner and are highly reliable. 

Also, since the checking of monitoring function 
is carried out electrically after turning power on and 
releasing resetting, checking can be done at high 
speed. 

40 Other features and objects of the present in- 

vention will become apparent from the following 
description made with reference to the accompany- 
ing drawings, in which: 

Fig. 1 is a block diagram showing the monitoring 
45 circuit according to the present invention; and 

Fig. 2 is a block diagram showing a conventional 
monitoring circuit. 
Fig. 1 shows one example of the electronic 
control circuit of the embodiment and is an entire 
so block diagram including an electric control circuit of 
ABS and its monitoring circuit. The signals that 
represent wheel speed information from wheel 
speed sensors S1 - S4 are converted into pulse 
signals in a digitalizing circuit 1. They are then split 
55 into two lines and read by two independent micro- 
computers 2, 2'. 

The two microcomputers 2, 2' operate on in- 
dependent reference time periods given by refer- 
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ence oscillators 3 and 3'. In the embodiment, each 
computer contains a predetermined program for 
calculating wheel speeds and slip rates based on 
the wheel speed information and is provided with a 
memory for storing these data and information. 

The output signals OUT of the microcomputers 
2 and 2\ which are the results of the calculations, 
are transmitted to loads such as solenoid valves 4 
through e.g. the above-described output determin- 
ing logic circuit (not shown). The solenoid valves 4 
are connected to an unillustrated power supply 
battery through a contact of a failsafe relay 5. By 
turning the failsafe relay 5 ON, the solenoid valves 
4 are ready ON-OFF control. 

The mutual monitoring circuit has the following 
structure. The microcomputers 2, 2* are provided 
with monitoring circuits 7, 7', respectively, for mon- 
itoring the watchdog pulse signals produced by 
their respective counterparts. The monitoring cir- 
cuits 7, T are a kind of watchdog timer circuits 
which operate independently of the software for- 
ming a program for antilock control. 

The monitoring circuits may comprise watch- 
dog timers having the function of e.g. retriggerable 
one-shot multivibrators or a similar function. The 
watchdog timers can measure the number and 
frequency of the watchdog pulses and detect both 
long-term and short-term abnormalities. The fre- 
quency of the watchdog pulses produced by each 
microcomputer is set, in a normal state, at a 50% 
duty ratio. The monitoring circuit has watchdog 
timers as judgement units which determine whether 
or not the frequency and duty of the pulse signals 
are normal. When the pulse signals are inputted as 
trigger signals, judgement on the frequency and 
duty is made in the judgement units. If it is judged 
that the microcomputer is functioning normally, a 
signal H is produced continuously. If judged ab- 
normal, a signal L is produced. 

As soon as one of the judgement units detects 
any abnormality, it produces abnormality judge- 
ment signals. But when the microcomputer on the 
other side returns to a normal state, the judgement 
unit will produce a normal judgement output after 
detecting a predetermined number of normal 
watchdog pulses or after detecting normal pulse 
signals continuous during a predetermined time. 

Further, electric control circuit of ABS has a so- 
called self diagnosis function that each microcom- 
puter monitors all of input and output signals so 
that it can find out any abnormality of its own 
system. And if either of microcomputers detects 
any abnormality of the system, it outputs a failsafe 
signal which is applied to an input signal of AND 
gate 8. 

Its output signals are applied to an FET of a 
driving circuit 9 as gate signals. Upon receipt of the 
gate signals, the driving circuit 9 drives the failsafe 



relay 5 to put the solenoid valves 4 and a motor 
relay in an operative state. 

Connections are made as shown in Fig. 1. A 
signal from the AND gate 8 to driving circuit 9 is 

5 representing abnormality judged from the above- 
described self-diagnosis of microcomputers. And 
wires or lines from WD signals of each microcom- 
puter to driving circuit 9 are representing abnormal- 
ity of either or both of microcomputers judged from 

70 mutual monitoring circuits 7, 7' which are mounted 
in the microcomputers. Also the output of a regu- 
lated voltage monitoring circuit 10 is connected to 
driving circuit 9. It is representing that regulated 
voltage which is a power supply of microcomputers 

75 is higher than predetermined value regarded as 
normal. 

The two microcomputers 2, 2' have the func- 
tion of monitoring, on their own, the results of 
judgement as to whether or not the programs in the 

20 normal and antilock control circuits are operating 
normally. This monitoring function in each com- 
puter is as follows: After switching on the ignition to 
turn the power on and releasing resetting, watch- 
dog pulse signals produced by one computer are 

25 fed into the other computer after deliberately turn- 
ing them into abnormal signals by means of a 
program for initial testing contained in the first 
computer; the second computer judges and moni- 
tors, on its own, the combination pattern of the 

30 abnormal and normal signals; and if the combina- 
tion pattern coincides with a predetermined pattern, 
the second computer determines that its own moni- 
toring function is normal. One bit in the register in 
each microcomputer is used for the judgement. If 

35 its function is abnormal, the signal fed to the one 
bit is checked and judged by a soft program. 

Also, in order that the microcomputers can be 
used for general purposes, they are ordinarily pro- 
vided with a stop mode or a halt mode. By apply- 

40 ing special commands, i.e. by a soft program, the 
crystal oscillator can be stopped from oscillating. 
Thus, if the software should go uncontrollable, the 
oscillator might stop oscillating. 

But according to this invention, in order to 

45 ensure high reliability, each microcomputer is pro- 
vided with a specific external terminal 11. By set- 
ting the external terminal 11 at Hi or Lo, the oscilla- 
tion stopping function with software is deleted. 
Namely, by setting the external terminal 11, the 

so crystal oscillating circuit in each microcomputer 
operates solely on hardware. 

The two microcomputers are monitored by the 
above-described monitoring circuit to see if they 
are operating normally in the following manner. 

55 For the antilock control, the two microcom- 

puters operate basically in the same way as con- 
ventional computers. Thus, no detailed description 
is made. 
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As far as there appears nothing abnormal dur- 
ing normal and antilock control operations, the two 
microcomputers 2, 2' both produce H signals as 
failsafe relay signals FS 0 , FSi , so that the AND 
gale 8 gives the H signal, to the gale of the driving 5 
circuit 9, thus turning the failsafe relay 5 ON. The 
AND gate 8 operates on the negative logic. 

On the other hand, the mutual monitoring cir- 
cuits 7, 7' monitor the two microcomputers to see if 
they are operating normally. The watchdog pulse 10 
signals as reference signals of one of the micro- 
computers are fed to the other microcomputer and 
checked by the mutual monitoring circuit in the 
latter computer. If it turns out that both microcom- 
puters are operating normally, a signal H as a 15 
judgement signal is produced and given to the gate 
signal line of the driving circuit 9 as described 
above. Also, if there is no abnormality in the regu- 
lated voltage, a signal H is given to the gate signal 
line from the regulated voltage monitoring unit 10. 20 

But if any one of the three kinds of monitoring 
signals turns out to be abnormal, for example, if the 
failsafe signal FS turns to L, the output of the AND 
gate 8 will also turn to L, so that the gate signal 
line of the driving circuit 9 will also turn to L even if 25 
the other signals are H. As a result, the failsafe 
relay 5 is cut. The same happens if the watchdog 
signal WD or the regulated voltage monitoring sig- 
nal turns to L. 

Thus, according to the above-described logic 30 
control, monitoring is carried out not only for the 
control operations by the two microcomputers but 
also for any abnormal behavior of the microcom- 
puters themselves. Provided outside the computers 
is only a gate driving circuit having a simple struc- 35 
ture. 

Claims 

1. In an electronic control circuit having a plurality 40 
of microcomputers which operate by mutually 
independent oscillating sources, wherein input 
signals such as speed information are divided 
and inputted in said respective microcom- 
puters, said microcomputers performing 45 
arithmetic operations according to a predeter- 
mined program based on said input signals, 
the electronic control circuit giving output con- 
trol signals based on the results of the 
arithmetic operations; a mutual monitoring cir- 50 
cuit for monitoring said plurality of microcom- 
puters, a monitoring circuit provided in said 
each microcomputer and being operative with- 
out any software for monitoring the other 
microcomputer, said one microcomputer send- 55 
ing watchdog signals to said monitoring circuit 
of the other microcomputer; a judgement unit 
provided in said monitoring circuit and receiv- 



ing watchdog signals from the other microcom- 
puter and judging whether the microcomputer 
is normal or not : and; a load shut-off means 
receiving the result of judgement and shutting 
off a load to be controlled if judged abnormal. 

2. A mutual monitoring circuit as claimed in claim 
1 wherein said judgement unit determines 
whether the pulse width and duty of the watch- 
dog signals are normal or not. 

3. A mutual monitoring circuit as claimed in claim 
1 or 2 wherein an input signal line of said load 
shut-off means is a negative-logic AND circuit 
and wherein the signals from said judgement 
unit are given to said AND circuit, thereby 
shutting off the load with said load shut-off 
means if the result of AND operation is ab- 
normal. 

4. A mutual monitoring circuit as claimed in any 
of claims 1-3 wherein though it outputs an 
abnormal judgement signal as soon as said 
judgement unit detects any abnormality, it out- 
puts a normal judgement signal when the other 
microcomputer returns to normal after detect- 
ing a predetermined number of normal pulse 
signals continuously or after detecting normal 
pulse signals continuous during a predeter- 
mined time. 

5. A mutual monitoring circuit as claimed in any 
of claims 1-4 wherein said each microcom- 
puter has a monitoring circuit which judges 
whether other microcomputer is normal or not. 

6. A mutual monitoring circuit as claimed in any 
of claims 1-5 wherein after turning power on 
and releasing resetting in said electronic con- 
trol circuit, an initial test is performed in which 
the watchdog pulse signals produced by said 
each microcomputer are converted deliberately 
into abnormal signals and sent to said monitor- 
ing circuit in the other microcomputer to check 
the monitoring function of the respective moni- 
toring circuits. 

7. A mutual monitoring circuit as claimed in any 
of claims 1-6 wherein said each microcom- 
puter has its specific external terminal set at 
High or Low whereby said each microcomputer 
can be set in a mode wherein the oscillation of 
quartz oscillators cannot be stopped by soft- 
ware. 
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FIG. 1 
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FIG. 2 
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© Mutual monitoring circuits for monitoring any ab- 
normality of a plurality of microcomputers in a con- 
trol circuit controlled thereby. Monitoring circuits are 
provided in two microcomputers, respectively, to 

^ monitor any abnormal behavior of their counterparts. 

^ Each mutual monitoring circuit has a judging unit for ' 
giving judgement on whether or not there is ab- 

J normality by measuring the pulse frequency and 
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duty of the pulse signals and for outputting ab- 
normality judgement signals upon detecting any ab- 
normality. The judgement signals are sent directly to 
an input signal line in a driving circuit of a failsafe 
relay as a load shut-off mechanism, thereby chang- 
ing its abnormality signals to a low level. This in turn 
stops the output of the driving circuit, thus shutting 
off the failsafe relay. 
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